Nix Podman Stacks

Appearance

socket-proxy ​

Security-enhanced proxy for the Docker/Podman Socket

Example ​

nix
{config, ...}: {
  nps.stacks.socket-proxy.enable = true;
}

Stack Options ​

nps.stacks.socket-proxy.enable ​

Whether to enable socket-proxy.

Type
plaintext
boolean
Default
nix
false
Example
nix
true
Declaration
<nps/modules/socket-proxy>

Container Extension ​

The socket-proxy adds the socketProxyPermissions option to the existing services.podman.containers.<name> options. Values are regex patterns per HTTP method, either from sections or custom. Setting it extends the module defaults, use lib.mkForce to replace them.

If a container has socketProxyPermissions configured, the container will automatically join the socket-proxyy network.

nix
{config, lib, ...}: {
  nps.stacks.mystack.containers.mycontainer.socketProxyPermissions = {
    GET = [
      config.nps.stacks.socket-proxy.sections.containers
      "some custom regexp"
    ];
  };
}

services.podman.containers.<name>.socketProxyPermissions ​

Regex allowlists for socket-proxy access, one list per HTTP method. Generates one label per pattern, e.g. socket-proxy.allow.get and socket-proxy.allow.get.1. See nps.stacks.socket-proxy.sections.

Type
plaintext
attribute set of list of string
Default
nix
{ }
Example
nix
{
  GET = [config.nps.stacks.socket-proxy.sections.containers];
  POST = [config.nps.stacks.socket-proxy.sections.build "some custom regex"];
}
Declaration
<nps/modules/socket-proxy/extension.nix>

Container Aliases ​

nps.stacks.socket-proxy.containers.socket-proxy ​

Alias of {option}services.podman.containers.socket-proxy.

Type
plaintext
submodule
Declaration
<nps/modules/socket-proxy>